Diagnosing Switch Problems
sFlow
OmniSwitch AOS Release 7 Network Configuration Guide
June 2013
page 32-29
sFlow
sFlow is a network monitoring technology that gives visibility in to the activity of the network, by provid-
ing network usage information. It provides the data required to effectively control and manage the network
usage. sFlow is a sampling technology that meets the requirements for a network traffic monitoring solu-
tion.
sFlow is an industry standard with many vendors delivering products with this support. Some of the appli-
cations of the sFlow data include:
•
Detecting, diagnosing, and fixing network problems
•
Real-time congestion management
•
Detecting unauthorized network activity
•
Usage accounting and billing
•
Understanding application mix
•
Route profiling and peer optimization
•
Capacity planning
sFlow is a sampling technology embedded within switches/routers. It provides the ability to monitor the
traffic flows. It requires a sFlow agent software process running as part of the switch software and a sFlow
collector which receives and analyses the monitored data. The sFlow collector makes use of SNMP to
communicate with a sFlow agent in order to configure sFlow monitoring on the device (switch).
sFlow agent running on the switch/router, combines interface counters and traffic flow (packet) samples
preferably on all the interfaces into sFlow datagrams that are sent across the network to an sFlow collec-
tor.
Packet sampling on the switch/router is typically performed by the switching/routing ASICs, providing
wire-speed performance. In this case, sFlow agent does very little processing, by packaging data into
sFlow datagrams that are immediately sent on network. This minimizes the memory and CPU utilization
by sFlow agent.
sFlow Manager
The sFlow manager is the controller for all the modules. It initializes all other modules. It interfaces with
the Ethernet driver to get the counter samples periodically and reads sampled packets. The counter
samples are given to the poller and sampled packets are given to the sampler to format a UDP packet.
Each sFlow manager instance has multiples of receiver, sampler, and poller instances. Each user
programmed port has an individual sampler and poller. The sampler and poller could be potentially point-
ing to multiple receivers if the user has configured multiple destination hosts.
Receiver
The receiver module has the details about the destination hosts where the sFlow datagrams are sent out. If
there are multiple destinations then each destination has an instance of the receiver. All these receivers are
attached to the sFlow manager instance and to an associated sample/poller.